技能 baoyu-markdown-to-html

📦

baoyu-markdown-to-html

內容修訂 r1 高風險 ⚙️ 外部命令📁 檔案系統存取⚡ 包含腳本🌐 網路存取🔑 環境變數

將 Markdown 轉換為樣式化 HTML

將 Markdown 發布為與 WeChat 相容的 HTML，可能需要仔細處理格式與行內樣式。此技能會將 Markdown 檔案轉換為帶有主題的 HTML，並支援圖表、數學公式、提示框與程式碼醒目提示。

支援: Claude Codex Code(CC)

Maintain this Skill? Claim it ⚠️ 38 差

此技能屬於一個技能包

安裝整套技能包，一條命令取得任務所需的所有技能。

文檔發布套件 · 3 技能安裝整個技能包

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "baoyu-markdown-to-html" from https://skillstore.io/skills/jimliu-baoyu-markdown-to-html.md and its manifest at https://skillstore.io/api/skills/jimliu-baoyu-markdown-to-html/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/jimliu-baoyu-markdown-to-html.md 已簽名 manifest GET /api/skills/jimliu-baoyu-markdown-to-html/manifest 已簽名 lockfile GET /api/skills/jimliu-baoyu-markdown-to-html/lockfile

測試它

正在使用「baoyu-markdown-to-html」。一篇含有 frontmatter、標題、程式碼區塊、提示框與本機圖片的 Markdown 文章。

預期結果:

HTML 文章會建立在 Markdown 檔案旁邊，並包含主題樣式與圖片對應關係清單。

正在使用「baoyu-markdown-to-html」。一份包含 Mermaid、PlantUML、數學公式與註腳的技術指南。

預期結果:

該指南會算繪為樣式化 HTML，包含圖表預留位置、格式化方程式、醒目提示程式碼與註腳區段。

正在使用「baoyu-markdown-to-html」。轉換前已存在 article.html。

預期結果:

先前的 HTML 檔案會以時間戳記備份，然後寫入新的主題化 HTML 檔案。

安全審計

高風險

v4 • 2026/7/5 開啟版本化報告

Confirmed risks include external npx/Bun execution, broad local file reads and writes, remote resource fetching, remote dynamic imports, and unsafe HTML insertion surfaces. Most backtick, regex exec, SVG coordinate, CSS border, and JSFuck heuristic hits are false positives from normal TypeScript and markup. No evidence of prompt injection text was found in SKILL.md or the scanned scripts.

20

已掃描檔案

3,739

分析行數

52

複核項目

0

已忽略的誤報

已確認的安全問題 (3)

高

scripts/md/render.ts:395-414 scripts/md/extensions/ruby.ts:91-120 scripts/md/extensions/slider.ts:57-60

Unsanitized Markdown HTML Output

Markdown-derived values are interpolated into HTML attributes and element bodies without consistent escaping. Malicious Markdown can produce active HTML when the output is opened or pasted into a privileged editor.

The renderer directly interpolates href, title, alt, ruby text, and slider captions into HTML strings. I did not find a sanitizer applied before the final HTML is written.

高

scripts/main.ts:80-89 scripts/main.ts:229-236

User-Controlled Remote Resource Fetching

Markdown image URLs beginning with http or https are downloaded during conversion. This can disclose network metadata or fetch attacker-controlled content when converting untrusted Markdown.

The code explicitly branches on http and https image paths, downloads them, and reports local mappings. The URL originates from Markdown image syntax collected earlier in the conversion.

高

scripts/md/render.ts:349-353 scripts/md/utils/languages.ts:80-112 scripts/md/utils/languages.ts:191-205

Remote Dynamic Import from Markdown Language Names

Unknown code block languages can be carried into a pending language attribute and later used to build a CDN import URL. This can load remote JavaScript based on document content.

The renderer stores an unregistered language name in HTML attributes, and the utility later imports grammarUrlFor(language). The exact caller path is browser-dependent, so confidence is high but not absolute.

能力複核項目 (52)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

scripts/main.ts:9

Node.js child_process module

import { spawnSync } from 'node:child_process';

The file imports node:child_process and the module is used later to invoke npx. This is real external command capability in the skill runtime.

高

scripts/main.ts:203

Synchronous spawn

const result = spawnSync('npx', args, {

spawnSync executes npx with Bun to run the renderer. The arguments are mostly controlled, but it still executes an external toolchain from the skill.

高

scripts/md/extensions/plantuml.ts:170

outerHTML assignment (XSS risk)

placeholderElement.outerHTML = createPlantUMLHTML(imageUrl, options, svgContent)

PlantUML inline rendering replaces an element with HTML built from fetched SVG content. Embedding remote SVG through outerHTML is a real injection surface.

高

scripts/md/utils/languages.ts:112

Dynamic import() expression

const module = await import(/* @vite-ignore */ grammarUrlFor(language))

The language highlighter dynamically imports a module URL built from a language name. If the language comes from Markdown, this can load remote code from the configured CDN.

中

scripts/main.ts:42

Node.js fs operations

fs.unlinkSync(destPath);

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/main.ts:50

Node.js fs operations

fs.unlinkSync(destPath);

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/main.ts:64

Node.js fs operations

fs.unlink(destPath, () => {});

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/main.ts:123

Node.js fs operations

const content = fs.readFileSync(markdownPath, 'utf-8');

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/main.ts:224

Node.js fs operations

fs.renameSync(finalHtmlPath, backupPath);

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/main.ts:227

Node.js fs operations

fs.copyFileSync(tempHtmlPath, finalHtmlPath);

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/main.ts:239

Node.js fs operations

let htmlContent = fs.readFileSync(finalHtmlPath, 'utf-8');

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/main.ts:244

Node.js fs operations

fs.writeFileSync(finalHtmlPath, htmlContent, 'utf-8');

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/main.ts:123

Synchronous file operations

const content = fs.readFileSync(markdownPath, 'utf-8');

The renderer performs synchronous reads or writes on local files during conversion. This is intentional but creates real filesystem access risk.

中

scripts/main.ts:239

Synchronous file operations

let htmlContent = fs.readFileSync(finalHtmlPath, 'utf-8');

The renderer performs synchronous reads or writes on local files during conversion. This is intentional but creates real filesystem access risk.

中

scripts/main.ts:244

Synchronous file operations

fs.writeFileSync(finalHtmlPath, htmlContent, 'utf-8');

The renderer performs synchronous reads or writes on local files during conversion. This is intentional but creates real filesystem access risk.

中

scripts/main.ts:35

File stream creation

const file = fs.createWriteStream(destPath);

The code creates a writable file stream for downloaded image content. This is real file creation based on conversion inputs.

中

scripts/main.ts:190

Temp directory access

const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'markdown-to-html-'));

The converter creates a temporary directory under the OS temp path and stores intermediate Markdown and assets there. Sensitive input could remain outside the project directory.

中

scripts/md/extensions/infographic.ts:77

innerHTML assignment (XSS risk)

container.innerHTML = `<div style="color: red; padding: 10px; border: 1px solid red;">Infographic 渲染

The catch block writes an error message into innerHTML. Error text may include untrusted content, so this is a plausible DOM injection risk.

中

scripts/md/extensions/plantuml.ts:193

Fetch API call

const response = await fetch(svgUrl)

fetch retrieves PlantUML SVG content from the generated diagram URL. This is real outbound network access during inline diagram rendering.

中

scripts/md/extensions/plantuml.ts:241

Hardcoded URL

serverUrl: options.serverUrl || `https://www.plantuml.com/plantuml`,

This is the default PlantUML server used for diagram rendering. Markdown diagrams can cause requests to this external service.

中

scripts/md/render.ts:81

Node.js fs operations

const content = fs.readFileSync(configPath, "utf-8");

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/md/render.ts:677

Node.js fs operations

baseCss: fs.readFileSync(basePath, "utf-8"),

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/md/render.ts:678

Node.js fs operations

themeCss: fs.readFileSync(themePath, "utf-8"),

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/md/render.ts:829

Node.js fs operations

const markdown = fs.readFileSync(inputPath, "utf-8");

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/md/render.ts:865

Node.js fs operations

fs.renameSync(outputPath, backupPath);

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/md/render.ts:868

Node.js fs operations

fs.writeFileSync(outputPath, finalHtml, "utf-8");

This is a real filesystem operation used to read, write, copy, rename, or delete conversion files. It is expected behavior but can affect user-selected paths.

中

scripts/md/render.ts:81

Synchronous file operations

const content = fs.readFileSync(configPath, "utf-8");

The renderer performs synchronous reads or writes on local files during conversion. This is intentional but creates real filesystem access risk.

中

scripts/md/render.ts:677

Synchronous file operations

baseCss: fs.readFileSync(basePath, "utf-8"),

The renderer performs synchronous reads or writes on local files during conversion. This is intentional but creates real filesystem access risk.

中

scripts/md/render.ts:678

Synchronous file operations

themeCss: fs.readFileSync(themePath, "utf-8"),

The renderer performs synchronous reads or writes on local files during conversion. This is intentional but creates real filesystem access risk.

中

scripts/md/render.ts:829

Synchronous file operations

const markdown = fs.readFileSync(inputPath, "utf-8");

The renderer performs synchronous reads or writes on local files during conversion. This is intentional but creates real filesystem access risk.

中

scripts/md/render.ts:868

Synchronous file operations

fs.writeFileSync(outputPath, finalHtml, "utf-8");

The renderer performs synchronous reads or writes on local files during conversion. This is intentional but creates real filesystem access risk.

中

scripts/md/utils/languages.ts:202

innerHTML assignment (XSS risk)

codeBlock.innerHTML = highlighted

The highlighter writes generated HTML into a code element with innerHTML. highlight.js usually escapes code, but this remains a DOM insertion sink.

中

scripts/md/utils/languages.ts:80

Hardcoded URL

const HLJS_CDN_BASE = `https://cdn-doocs.oss-cn-shenzhen.aliyuncs.com/npm/highlightjs/${HLJS_VERSION

This URL is the CDN base used by dynamic language loading. It can be contacted when loading additional highlight.js grammars.

中

Hidden file access

test -f "$HOME/.baoyu-skills/baoyu-markdown-to-html/EXTEND.md" && echo "user"

SKILL.md instructs the agent to check a hidden .baoyu-skills EXTEND.md path, including a user-home location. This is intentional configuration access but reaches hidden files.

中

Hidden file access

│ $HOME/.baoyu-skills/baoyu-markdown-to-html/EXTEND.md │ User home │

SKILL.md instructs the agent to check a hidden .baoyu-skills EXTEND.md path, including a user-home location. This is intentional configuration access but reaches hidden files.

低

scripts/main.ts:86

Node.js fs stat operations

if (!fs.existsSync(localPath)) {

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/main.ts:214

Node.js fs stat operations

if (!fs.existsSync(tempHtmlPath)) {

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/main.ts:221

Node.js fs stat operations

if (fs.existsSync(finalHtmlPath)) {

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/main.ts:321

Node.js fs stat operations

if (!fs.existsSync(markdownPath)) {

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/main.ts:190

Temp file creation

const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'markdown-to-html-'));

The same temp directory is used for generated intermediate files. This is expected but can leave temporary copies of source content.

低

scripts/md/render.ts:67

Node.js fs stat operations

if (!fs.existsSync(dir)) {

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/md/render.ts:78

Node.js fs stat operations

if (!fs.existsSync(configPath)) {

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/md/render.ts:101

Node.js fs stat operations

fs.existsSync(path.join(THEME_DIR, `${name}.css`))

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/md/render.ts:102

Node.js fs stat operations

|| fs.existsSync(path.join(EXTERNAL_THEME_DIR, `${name}.css`))

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/md/render.ts:658

Node.js fs stat operations

fs.existsSync(candidate)

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/md/render.ts:661

Node.js fs stat operations

fs.existsSync(candidate)

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/md/render.ts:817

Node.js fs stat operations

if (!fs.existsSync(inputPath)) {

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/md/render.ts:863

Node.js fs stat operations

if (fs.existsSync(outputPath)) {

The code checks filesystem paths with existsSync before reading or writing. This is legitimate but still observes local path state.

低

scripts/md/render.ts:36

Environment variable access (dot notation)

process.env.MD_THEME_CONFIG_PATH

The renderer reads MD_THEME_CONFIG_PATH and MD_THEME_DIR from process.env to choose theme sources. These are configuration variables, not direct secret exfiltration.

低

scripts/md/render.ts:39

Environment variable access (dot notation)

process.env.MD_THEME_DIR

The renderer reads MD_THEME_CONFIG_PATH and MD_THEME_DIR from process.env to choose theme sources. These are configuration variables, not direct secret exfiltration.

低

scripts/md/render.ts:36

Environment variable object

process.env.MD_THEME_CONFIG_PATH

The renderer reads MD_THEME_CONFIG_PATH and MD_THEME_DIR from process.env to choose theme sources. These are configuration variables, not direct secret exfiltration.

低

scripts/md/render.ts:39

Environment variable object

process.env.MD_THEME_DIR

The renderer reads MD_THEME_CONFIG_PATH and MD_THEME_DIR from process.env to choose theme sources. These are configuration variables, not direct secret exfiltration.

風險因素

⚙️ 外部命令 (366)

scripts/main.ts:9 scripts/main.ts:203 scripts/main.ts:29 scripts/main.ts:51 scripts/main.ts:84 scripts/main.ts:87 scripts/main.ts:170 scripts/main.ts:183-188 scripts/main.ts:188 scripts/main.ts:198-210 scripts/main.ts:210-215 scripts/main.ts:215-222 scripts/main.ts:222-223 scripts/main.ts:223-241 scripts/main.ts:241-246 scripts/main.ts:246-259 scripts/main.ts:288-322 scripts/main.ts:322-331 scripts/md/extensions/alert.ts:116 scripts/md/extensions/alert.ts:26 scripts/md/extensions/alert.ts:36 scripts/md/extensions/alert.ts:47 scripts/md/extensions/alert.ts:48 scripts/md/extensions/alert.ts:52 scripts/md/extensions/alert.ts:53 scripts/md/extensions/alert.ts:57 scripts/md/extensions/alert.ts:59 scripts/md/extensions/alert.ts:66 scripts/md/extensions/alert.ts:70 scripts/md/extensions/alert.ts:75 scripts/md/extensions/alert.ts:78 scripts/md/extensions/alert.ts:83-89 scripts/md/extensions/alert.ts:89-90 scripts/md/extensions/alert.ts:90-93 scripts/md/extensions/alert.ts:93-104 scripts/md/extensions/alert.ts:104-105 scripts/md/extensions/alert.ts:105-109 scripts/md/extensions/alert.ts:109-110 scripts/md/extensions/alert.ts:110-125 scripts/md/extensions/alert.ts:125-144 scripts/md/extensions/alert.ts:144-145 scripts/md/extensions/alert.ts:145-148 scripts/md/extensions/alert.ts:148-149 scripts/md/extensions/alert.ts:149-152 scripts/md/extensions/alert.ts:152-153 scripts/md/extensions/alert.ts:153-156 scripts/md/extensions/alert.ts:156-157 scripts/md/extensions/alert.ts:157-160 scripts/md/extensions/alert.ts:160-161 scripts/md/extensions/alert.ts:161-164 scripts/md/extensions/alert.ts:164-165 scripts/md/extensions/alert.ts:165-169 scripts/md/extensions/alert.ts:169-170 scripts/md/extensions/alert.ts:170-171 scripts/md/extensions/alert.ts:171-174 scripts/md/extensions/alert.ts:174-175 scripts/md/extensions/alert.ts:175-176 scripts/md/extensions/alert.ts:176-179 scripts/md/extensions/alert.ts:179-180 scripts/md/extensions/alert.ts:180-181 scripts/md/extensions/alert.ts:181-184 scripts/md/extensions/alert.ts:184-185 scripts/md/extensions/alert.ts:185-186 scripts/md/extensions/alert.ts:186-189 scripts/md/extensions/alert.ts:189-190 scripts/md/extensions/alert.ts:190-191 scripts/md/extensions/alert.ts:191-194 scripts/md/extensions/alert.ts:194-195 scripts/md/extensions/alert.ts:195-196 scripts/md/extensions/alert.ts:196-199 scripts/md/extensions/alert.ts:199-200 scripts/md/extensions/alert.ts:200-201 scripts/md/extensions/alert.ts:201-204 scripts/md/extensions/alert.ts:204-205 scripts/md/extensions/alert.ts:205-206 scripts/md/extensions/alert.ts:206-209 scripts/md/extensions/alert.ts:209-210 scripts/md/extensions/alert.ts:210-211 scripts/md/extensions/alert.ts:211-214 scripts/md/extensions/alert.ts:214-215 scripts/md/extensions/alert.ts:215-216 scripts/md/extensions/alert.ts:216-219 scripts/md/extensions/alert.ts:219-220 scripts/md/extensions/alert.ts:220-221 scripts/md/extensions/alert.ts:221-224 scripts/md/extensions/alert.ts:224-225 scripts/md/extensions/alert.ts:225-226 scripts/md/extensions/alert.ts:226-229 scripts/md/extensions/alert.ts:229-230 scripts/md/extensions/alert.ts:230-231 scripts/md/extensions/alert.ts:231-234 scripts/md/extensions/alert.ts:234-235 scripts/md/extensions/alert.ts:235-236 scripts/md/extensions/alert.ts:236-239 scripts/md/extensions/alert.ts:239-240 scripts/md/extensions/alert.ts:240-241 scripts/md/extensions/alert.ts:241-244 scripts/md/extensions/alert.ts:244-245 scripts/md/extensions/alert.ts:245-246 scripts/md/extensions/alert.ts:246-249 scripts/md/extensions/alert.ts:249-250 scripts/md/extensions/alert.ts:250-251 scripts/md/extensions/alert.ts:251-254 scripts/md/extensions/alert.ts:254-255 scripts/md/extensions/alert.ts:255-256 scripts/md/extensions/alert.ts:256-283 scripts/md/extensions/footnotes.ts:21 scripts/md/extensions/footnotes.ts:22 scripts/md/extensions/footnotes.ts:34 scripts/md/extensions/footnotes.ts:45-49 scripts/md/extensions/footnotes.ts:51-52 scripts/md/extensions/footnotes.ts:55 scripts/md/extensions/footnotes.ts:61 scripts/md/extensions/footnotes.ts:62 scripts/md/extensions/footnotes.ts:72 scripts/md/extensions/footnotes.ts:82-84 scripts/md/extensions/infographic.ts:94 scripts/md/extensions/infographic.ts:32 scripts/md/extensions/infographic.ts:34 scripts/md/extensions/infographic.ts:77 scripts/md/extensions/infographic.ts:91-94 scripts/md/extensions/infographic.ts:94 scripts/md/extensions/infographic.ts:104-109 scripts/md/extensions/katex.ts:23 scripts/md/extensions/katex.ts:24 scripts/md/extensions/katex.ts:28 scripts/md/extensions/katex.ts:31 scripts/md/extensions/katex.ts:32 scripts/md/extensions/katex.ts:33 scripts/md/extensions/katex.ts:39 scripts/md/extensions/katex.ts:42 scripts/md/extensions/katex.ts:50 scripts/md/extensions/katex.ts:51 scripts/md/extensions/katex.ts:57 scripts/md/extensions/katex.ts:61 scripts/md/extensions/katex.ts:70-77 scripts/md/extensions/katex.ts:77-90 scripts/md/extensions/katex.ts:90-91 scripts/md/extensions/katex.ts:91-96 scripts/md/extensions/katex.ts:96-109 scripts/md/extensions/katex.ts:109-110 scripts/md/extensions/katex.ts:110-112 scripts/md/extensions/katex.ts:112-119 scripts/md/extensions/katex.ts:119-132 scripts/md/extensions/katex.ts:132-133 scripts/md/extensions/katex.ts:133-135 scripts/md/extensions/katex.ts:135-142 scripts/md/extensions/markup.ts:21 scripts/md/extensions/markup.ts:45 scripts/md/extensions/markup.ts:71 scripts/md/extensions/markup.ts:14 scripts/md/extensions/markup.ts:15 scripts/md/extensions/markup.ts:24 scripts/md/extensions/markup.ts:32 scripts/md/extensions/markup.ts:38 scripts/md/extensions/markup.ts:39 scripts/md/extensions/markup.ts:48 scripts/md/extensions/markup.ts:56 scripts/md/extensions/markup.ts:62 scripts/md/extensions/markup.ts:63 scripts/md/extensions/markup.ts:74 scripts/md/extensions/markup.ts:82 scripts/md/extensions/plantuml.ts:266 scripts/md/extensions/plantuml.ts:14 scripts/md/extensions/plantuml.ts:51 scripts/md/extensions/plantuml.ts:54 scripts/md/extensions/plantuml.ts:56 scripts/md/extensions/plantuml.ts:68-81 scripts/md/extensions/plantuml.ts:81-112 scripts/md/extensions/plantuml.ts:112-132 scripts/md/extensions/plantuml.ts:132-135 scripts/md/extensions/plantuml.ts:135 scripts/md/extensions/plantuml.ts:144 scripts/md/extensions/plantuml.ts:145 scripts/md/extensions/plantuml.ts:155 scripts/md/extensions/plantuml.ts:156 scripts/md/extensions/plantuml.ts:162 scripts/md/extensions/plantuml.ts:164 scripts/md/extensions/plantuml.ts:168 scripts/md/extensions/plantuml.ts:176 scripts/md/extensions/plantuml.ts:177 scripts/md/extensions/plantuml.ts:178-180 scripts/md/extensions/plantuml.ts:182-195 scripts/md/extensions/plantuml.ts:195-201 scripts/md/extensions/plantuml.ts:201-202 scripts/md/extensions/plantuml.ts:202-204 scripts/md/extensions/plantuml.ts:204-205 scripts/md/extensions/plantuml.ts:205-208 scripts/md/extensions/plantuml.ts:208-209 scripts/md/extensions/plantuml.ts:209-219 scripts/md/extensions/plantuml.ts:219 scripts/md/extensions/plantuml.ts:220-221 scripts/md/extensions/plantuml.ts:221-225 scripts/md/extensions/plantuml.ts:227-231 scripts/md/extensions/plantuml.ts:233-241 scripts/md/extensions/plantuml.ts:241-242 scripts/md/extensions/plantuml.ts:242-243 scripts/md/extensions/plantuml.ts:243-247 scripts/md/extensions/plantuml.ts:247-248 scripts/md/extensions/plantuml.ts:248-249 scripts/md/extensions/plantuml.ts:249-258 scripts/md/extensions/plantuml.ts:258-259 scripts/md/extensions/plantuml.ts:259-261 scripts/md/extensions/plantuml.ts:261-262 scripts/md/extensions/plantuml.ts:262-266 scripts/md/extensions/plantuml.ts:266 scripts/md/extensions/plantuml.ts:271-284 scripts/md/extensions/plantuml.ts:284 scripts/md/extensions/ruby.ts:31 scripts/md/extensions/ruby.ts:44 scripts/md/extensions/ruby.ts:13 scripts/md/extensions/ruby.ts:14 scripts/md/extensions/ruby.ts:15 scripts/md/extensions/ruby.ts:16 scripts/md/extensions/ruby.ts:22 scripts/md/extensions/ruby.ts:23 scripts/md/extensions/ruby.ts:34 scripts/md/extensions/ruby.ts:38 scripts/md/extensions/ruby.ts:47 scripts/md/extensions/ruby.ts:51 scripts/md/extensions/ruby.ts:66-68 scripts/md/extensions/ruby.ts:68-89 scripts/md/extensions/ruby.ts:89-91 scripts/md/extensions/ruby.ts:91-98 scripts/md/extensions/ruby.ts:98-106 scripts/md/extensions/ruby.ts:106-109 scripts/md/extensions/ruby.ts:109-117 scripts/md/extensions/ruby.ts:117-120 scripts/md/extensions/slider.ts:11 scripts/md/extensions/slider.ts:12 scripts/md/extensions/slider.ts:21 scripts/md/extensions/slider.ts:33-39 scripts/md/extensions/slider.ts:39-40 scripts/md/extensions/slider.ts:40-49 scripts/md/extensions/slider.ts:57-60 scripts/md/extensions/slider.ts:60-68 scripts/md/extensions/toc.ts:34 scripts/md/extensions/toc.ts:17 scripts/md/extensions/toc.ts:18-26 scripts/md/extensions/toc.ts:26-27 scripts/md/extensions/toc.ts:27-37 scripts/md/extensions/toc.ts:37-44 scripts/md/extensions/toc.ts:44-45 scripts/md/extensions/toc.ts:45-50 scripts/md/extensions/toc.ts:50-55 scripts/md/extensions/toc.ts:55-58 scripts/md/extensions/toc.ts:58-63 scripts/md/extensions/toc.ts:63-66 scripts/md/render.ts:101 scripts/md/render.ts:102 scripts/md/render.ts:151-155 scripts/md/render.ts:170-177 scripts/md/render.ts:177-178 scripts/md/render.ts:178-196 scripts/md/render.ts:202-241 scripts/md/render.ts:241-243 scripts/md/render.ts:243-279 scripts/md/render.ts:283-300 scripts/md/render.ts:300-334 scripts/md/render.ts:334-347 scripts/md/render.ts:347-351 scripts/md/render.ts:351-353 scripts/md/render.ts:353-355 scripts/md/render.ts:355-381 scripts/md/render.ts:381-392 scripts/md/render.ts:392-398 scripts/md/render.ts:398-399 scripts/md/render.ts:399-405 scripts/md/render.ts:405-412 scripts/md/render.ts:412-414 scripts/md/render.ts:414-438 scripts/md/render.ts:445-496 scripts/md/render.ts:496-533 scripts/md/render.ts:533-542 scripts/md/render.ts:542-572 scripts/md/render.ts:572-576 scripts/md/render.ts:576-615 scripts/md/render.ts:621-622 scripts/md/render.ts:628-634 scripts/md/render.ts:636-654 scripts/md/render.ts:654-655 scripts/md/render.ts:655-666 scripts/md/render.ts:666-672 scripts/md/render.ts:672-683 scripts/md/render.ts:702-724 scripts/md/render.ts:724-727 scripts/md/render.ts:727-730 scripts/md/render.ts:730-733 scripts/md/render.ts:733-756 scripts/md/render.ts:756-780 scripts/md/render.ts:780-784 scripts/md/render.ts:784-788 scripts/md/render.ts:788-818 scripts/md/render.ts:818-864 scripts/md/render.ts:864-871 scripts/md/render.ts:871-873 scripts/md/utils/languages.ts:79 scripts/md/utils/languages.ts:80 scripts/md/utils/languages.ts:89 scripts/md/utils/languages.ts:116 scripts/md/utils/languages.ts:134 scripts/md/utils/languages.ts:135 scripts/md/utils/languages.ts:137 scripts/md/utils/languages.ts:141 scripts/md/utils/languages.ts:145 scripts/md/utils/languages.ts:160-163 scripts/md/utils/languages.ts:163 scripts/md/utils/languages.ts:168 scripts/md/utils/languages.ts:171 scripts/md/utils/languages.ts:172-173 scripts/md/utils/languages.ts:173-174 scripts/md/utils/languages.ts:174-176 scripts/md/utils/languages.ts:181-192 scripts/md/utils/languages.ts:192-193 scripts/md/utils/languages.ts:193 scripts/md/utils/languages.ts:198-203 scripts/md/utils/languages.ts:203-204 scripts/md/utils/languages.ts:204-205 scripts/md/utils/languages.ts:205-215 scripts/md/utils/languages.ts:215-218 scripts/md/utils/languages.ts:218-232 scripts/md/utils/languages.ts:232-233 scripts/md/utils/languages.ts:233-234 SKILL.md:12 SKILL.md:16 SKILL.md:22-28 SKILL.md:28-61 SKILL.md:61-63 SKILL.md:63-64 SKILL.md:64-67 SKILL.md:67-77 SKILL.md:77-78 SKILL.md:78-79 SKILL.md:79-83 SKILL.md:83-85 SKILL.md:85-93 SKILL.md:93-95 SKILL.md:95-101 SKILL.md:101-102 SKILL.md:102-103 SKILL.md:103-104 SKILL.md:104-108 SKILL.md:108-120 SKILL.md:120-125 SKILL.md:125-126 SKILL.md:126-129 SKILL.md:129-133 SKILL.md:133-148 SKILL.md:148-154 SKILL.md:154-155 SKILL.md:155-156 SKILL.md:156-162 SKILL.md:162 SKILL.md:163 SKILL.md:164 SKILL.md:165 SKILL.md:167-168 SKILL.md:168-169 SKILL.md:169-170 SKILL.md:170 SKILL.md:171 SKILL.md:172-173 SKILL.md:173-174 SKILL.md:174 SKILL.md:175 SKILL.md:181-187

📁 檔案系統存取 (46)

scripts/main.ts:42 scripts/main.ts:50 scripts/main.ts:64 scripts/main.ts:123 scripts/main.ts:224 scripts/main.ts:227 scripts/main.ts:239 scripts/main.ts:244 scripts/main.ts:86 scripts/main.ts:214 scripts/main.ts:221 scripts/main.ts:321 scripts/main.ts:123 scripts/main.ts:239 scripts/main.ts:244 scripts/main.ts:35 scripts/main.ts:164 scripts/main.ts:190 scripts/main.ts:190 scripts/md/extensions/alert.ts:116 scripts/md/extensions/infographic.ts:94 scripts/md/extensions/plantuml.ts:266 scripts/md/extensions/toc.ts:34 scripts/md/render.ts:81 scripts/md/render.ts:677 scripts/md/render.ts:678 scripts/md/render.ts:829 scripts/md/render.ts:865 scripts/md/render.ts:868 scripts/md/render.ts:67 scripts/md/render.ts:78 scripts/md/render.ts:101 scripts/md/render.ts:102 scripts/md/render.ts:658 scripts/md/render.ts:661 scripts/md/render.ts:817 scripts/md/render.ts:863 scripts/md/render.ts:81 scripts/md/render.ts:677 scripts/md/render.ts:678 scripts/md/render.ts:829 scripts/md/render.ts:868 scripts/md/render.ts:242 scripts/md/render.ts:404 SKILL.md:27 SKILL.md:35

⚡ 包含腳本 (16)

scripts/md/extensions/alert.ts:116 scripts/md/extensions/infographic.ts:12 scripts/md/extensions/infographic.ts:77 scripts/md/extensions/infographic.ts:94 scripts/md/extensions/markup.ts:21 scripts/md/extensions/markup.ts:45 scripts/md/extensions/markup.ts:71 scripts/md/extensions/plantuml.ts:170 scripts/md/extensions/plantuml.ts:266 scripts/md/extensions/ruby.ts:31 scripts/md/extensions/ruby.ts:44 scripts/md/extensions/toc.ts:34 scripts/md/render.ts:329 scripts/md/render.ts:747 scripts/md/utils/languages.ts:112 scripts/md/utils/languages.ts:202

🌐 網路存取 (32)

scripts/md/extensions/alert.ts:21 scripts/md/extensions/alert.ts:23 scripts/md/extensions/alert.ts:153 scripts/md/extensions/alert.ts:157 scripts/md/extensions/alert.ts:165 scripts/md/extensions/alert.ts:171 scripts/md/extensions/alert.ts:176 scripts/md/extensions/alert.ts:181 scripts/md/extensions/alert.ts:186 scripts/md/extensions/alert.ts:191 scripts/md/extensions/alert.ts:196 scripts/md/extensions/alert.ts:201 scripts/md/extensions/alert.ts:206 scripts/md/extensions/alert.ts:211 scripts/md/extensions/alert.ts:216 scripts/md/extensions/alert.ts:221 scripts/md/extensions/alert.ts:226 scripts/md/extensions/alert.ts:231 scripts/md/extensions/alert.ts:236 scripts/md/extensions/alert.ts:241 scripts/md/extensions/alert.ts:251 scripts/md/extensions/alert.ts:256 scripts/md/extensions/katex.ts:26 scripts/md/extensions/plantuml.ts:193 scripts/md/extensions/plantuml.ts:7 scripts/md/extensions/plantuml.ts:35 scripts/md/extensions/plantuml.ts:61 scripts/md/extensions/plantuml.ts:78 scripts/md/extensions/plantuml.ts:241 scripts/md/extensions/ruby.ts:5 scripts/md/LICENSE:3 scripts/md/utils/languages.ts:80

🔑 環境變數 (4)

scripts/md/render.ts:36 scripts/md/render.ts:39 scripts/md/render.ts:36 scripts/md/render.ts:39

審計單位: codex 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

安全評估

複製報告連結

https://skillstore.io/skills/jimliu-baoyu-markdown-to-html/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/jimliu-baoyu-markdown-to-html/security.svg)](https://skillstore.io/skills/jimliu-baoyu-markdown-to-html?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/jimliu-baoyu-markdown-to-html?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/jimliu-baoyu-markdown-to-html/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/jimliu-baoyu-markdown-to-html.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

jimliu. (2026). baoyu-markdown-to-html security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/jimliu-baoyu-markdown-to-html/audits/4

BibTeX 引用

@techreport{jimliu-jimliu-baoyu-markdown-to-html-2026,
  author = {jimliu},
  title = {baoyu-markdown-to-html security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/jimliu-baoyu-markdown-to-html/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "baoyu-markdown-to-html security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "jimliu"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/jimliu-baoyu-markdown-to-html/audits/4"
identifiers:
  - type: other
    value: "skillstore:jimliu-baoyu-markdown-to-html:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 高

45

架構

85

可維護性

85

內容

70

社群

83

規範符合度

你可以打造什麼

準備 WeChat 文章

將完成的 Markdown 文章轉換為樣式化 HTML，適合貼入發布工作流程。

發布技術指南

以一致的 HTML 樣式算繪程式碼區塊、圖表、提示框與數學公式，用於開發者教育。

格式化文件草稿

將含有 frontmatter 與圖片的 Markdown 草稿轉換為可供審閱的 HTML 交付成果。

試試這些提示

轉換單一檔案

將 article.md 轉換為使用 default theme 的樣式化 HTML。回報輸出路徑與任何備份路徑。

使用主題

使用 grace theme 轉換 draft.md。在算繪內容中保留第一個標題。

準備發布草稿

將 post.md 轉換為 HTML，使用 frontmatter 中的 title，並列出我必須檢查的任何圖片對應關係。

算繪技術文章

轉換包含圖表、數學公式、提示框與程式碼區塊的 guide.md。使用 simple theme，並保留現有的輸出備份。

最佳實務

轉換前先審閱來自不受信任來源的 Markdown。
不需要網路存取時，請使用本機圖片。
轉換前先選擇主題，以避免重複變更輸出。

避免

在共享機器上，未審閱暫存檔案前，不要轉換機密或私有 Markdown。
不要將由不受信任 Markdown 產生的 HTML 貼入具高權限的網頁。
不要依賴遠端圖表或圖片進行離線發布。

常見問題

這個技能會產生什麼？

它會從 Markdown 輸入檔案產生樣式化 HTML 檔案。

哪些工具可以使用它？

報告列出 Claude、Codex 和 Claude Code 為支援的工具。

包含哪些主題？

此技能記載了 default、grace 和 simple 主題。

它支援圖表嗎？

是。它包含對 Mermaid 與 PlantUML 圖表區塊的支援。

HTML 會儲存在哪裡？

HTML 檔案會儲存在與 Markdown 輸入檔案相同的目錄中。

它對不受信任的 Markdown 安全嗎？

不安全。使用來自不受信任 Markdown 的輸出前，需要額外清理。

開發者詳細資訊

作者

授權

MIT

Skillstore 修訂

r1

版本提示

作者未聲明版本。

儲存庫

https://github.com/jimliu/baoyu-skills/tree/main/skills/baoyu-markdown-to-html/

引用

a25199bc7d6b82598536822d1738eb5d5f54025b

維護新鮮度

2026/7/18

使用量

14 次下載 · 221 次瀏覽

檔案結構

📁 md/

📁 extensions/

📄 footnotes.ts

📄 infographic.ts

📄 plantuml.ts

📄 default.css

📄 simple.css

📄 languages.ts

📄 package.json

jimliu 的更多技能

baoyu-comic

從來源素材建立知識漫畫

冗長的來源素材很難轉化為清楚的視覺化課程。這項技能會引導 Claude、Codex 或 Claude Code 完成分析、分鏡、圖像提示詞和 PDF 組裝。

設計與創意查看

baoyu-format-markdown

格式化 Markdown 文章

草稿通常缺乏一致的結構、frontmatter 與易讀的排版。此技能會將純文字或粗略的 Markdown 轉換成組織完善、可供審閱的 Markdown。

baoyu-article-illustrator

以一致的視覺風格為文章繪製插圖

長篇文章通常需要視覺素材，但選擇圖片位置和提示詞很耗時。此技能會分析 Markdown 內容、規劃插圖，並建立一致的提示詞與圖片放置位置。

設計與創意查看

baoyu-cover-image

建立文章封面圖片

文章封面通常需要在開始生成圖片前，先有清楚的視覺概念。此技能會分析內容，並建立符合風格的封面提示詞，包含標題與版面配置指引。

設計與創意查看

release-skills

安全發布 Baoyu Skills

手動發布可能會遺漏變更日誌、版本與標籤步驟。此技能會引導 baoyu-skills 的可重複發布工作流程，包含雙語變更日誌與本機 git 標籤。

DevOps 與基礎設施查看

baoyu-infographic

從結構化內容建立資訊圖表

將筆記或報告轉換成清楚的視覺內容，可能需要做出許多設計決策。此技能會分析內容、推薦版面配置與風格，並為 Claude、Codex 或 Claude Code 工作流程準備圖片提示詞。

設計與創意查看

mermaid-diagrams

為軟體文件建立 Mermaid 圖表

由 softaworks

團隊經常需要清晰且貼近程式碼與文件的圖表。此技能會引導 Claude、Codex 和 Claude Code 使用 Mermaid 語法，建立可維護的視覺模型。

markdown-pro

建立專業 Markdown 文件

由 AutumnsGrove

團隊需要清晰的專案文件，並在 README 檔案、變更日誌與貢獻指南之間保持一致。Markdown Pro 提供範本、結構與輔助工作流程，用於製作精緻的技術文件。

c4-architecture

建立 C4 架構圖

由 softaworks

架構文件常常會變得不清楚，或對其受眾而言過於詳細。此技能會為系統脈絡、容器、元件、部署和流程建立聚焦的 C4 Mermaid 圖表。

docs-write

撰寫 Metabase 文件

由 metabase

產品文件常常變得過於正式、含糊，或難以快速瀏覽。此技能可協助 Claude、Codex 和 Claude Code 撰寫 Metabase 風格的文件，使內容清楚、直接，並以讀者為中心。

doc-writer

建立結構化任務文件

由 0xhiroki

當計畫、需求和驗證步驟分散各處時，團隊經常會遺失任務脈絡。此技能會根據儲存庫脈絡與範本建立一致的任務文件。

markdown

對 Markdown 文件進行 Lint 檢查與修正

由 46ki75

Markdown 檔案經常偏離專案風格規則，變得更難維護。這項技能會引導 Claude、Codex 和 Claude Code 透過 markdownlint-cli2 進行檢查、修正與清楚回報。